From: IRM (irm@iinet.net.au)
Date: Mon May 21 2007 - 06:09:59 EDT
Dear all,
On my recent pen test, I have seen on Unix Apps (written in C) relies on
UNIX authentication (/etc/passwd and /etc/group) to determine which
functionalities the user can access to.
1) My first question would be what is the rationale of having such
design? Obviously the authentication design is open to not only the
application users but to the operating system users.
2) I know on some Unix/Linux flavors, the system could enforce the user
to change their password every X days. If I am not wrong this setting
can be set through "/etc/shadow" but what if the user never accesses
their Shell?
Would it still enforce the user to change their password?
(say on /etc/passwd; username .......: :::::: /bin/apps - instead of
/bin/sh) - so when the user is actually connect to the terminal, its
automatically run the application and not a shell - if I am not wrong
.Profile is run after /bin/sh is called?
Cheers,
John,
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:49 EDT